Skip to main content
Every request sends a Bearer token:
Pekto accepts three kinds of token. Each one only ever reaches the projects, brand kits and posts of the account it belongs to.

​
API keys

Create keys in Settings → Developer: give the key a name, choose its scopes and an optional expiry, then copy the secret. Pekto stores only a hash and can’t show it again. From the same page you can see when each key was last used and revoke it at once.
  • Up to 20 active keys per account
  • 60 requests a minute per key (see Limits)
  • Keys can’t create or revoke other keys
Treat a key like a password. Keep it in a secret store or environment variable, never in client-side code or a public repository. If one leaks, revoke it in Settings → Developer.

​
Sign in with Pekto (OAuth)

AI tools connect with OAuth 2.1, so nobody pastes a key into a chat app. The tool finds the sign-in server on its own:
  1. It calls https://api.trypekto.com/mcp and gets 401 with a WWW-Authenticate header pointing at the protected resource metadata.
  2. It registers itself and opens Pekto’s sign-in in your browser.
  3. You sign in and see which app is asking and what it will be able to do, then choose Allow or Deny.
  4. The app receives a token and every MCP call runs as you.
A connected app can read your projects, templates and brand kits; create presentations and carousels (using your credits); edit, duplicate and delete projects; create and delete brand kits; and read your social accounts and schedule or delete unpublished posts. It can’t see your password or manage API keys. Each app is limited to 120 requests a minute. Disconnect an app any time in Settings → Developer → Connected apps. It’s signed out immediately.

​
Scopes

A request without the scope it needs returns 403 insufficient_scope, with the missing scope in error.details.required_scope.